Bug 863087 (CVE-2013-7323) - VUL-0: python-gnupg: several security fixes to prevent shell code injection
Summary: VUL-0: python-gnupg: several security fixes to prevent shell code injection
Status: RESOLVED FIXED
Alias: CVE-2013-7323
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.1
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Alexandre Rogoski
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-02-10 16:21 UTC by Alexander Bergmann
Modified: 2017-05-26 19:13 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexander Bergmann 2014-02-10 16:21:16 UTC 
Version 0.3.6 of python-gnupg includes several security fixes. 3 CVEs where assigned to this problems.

From the CHANGE LOG:
"Note also that this release includes security improvements, so all users are encouraged to upgrade."

CVE-2013-7323 Unrestricted use of unquoted strings in a shell,
              within version 0.3.4

CVE-2014-1927 Erroneous assumptions about the usability of "
              characters within version 0.3.5, leading to attacks
              such as $( command substitution within a "-quoted
              string

CVE-2014-1928 Erroneous insertion of a \ character within version
              0.3.5, leading to attacks involving command lists
              (such as lists separated by a ; character)

This problem needs to be addressed to openSUSE:12.3 and openSUSE:13.1.

References:
http://seclists.org/oss-sec/2014/q1/243
https://code.google.com/p/python-gnupg/
https://code.google.com/p/python-gnupg/issues/detail?id=98#c4
https://bugzilla.redhat.com/show_bug.cgi?id=1061599
Comment 1 Swamp Workflow Management 2014-02-10 23:00:20 UTC 
bugbot adjusting priority
Comment 2 Benjamin Brunner 2014-02-17 13:32:11 UTC 
I'm not sure why this bug is assigned to maintenance@opensuse.org. Alexandre, if you have a fix, please open a maintenancerequest with your fixed package. (keep in mind to add the bugids, cveids and added/changed patches to your changelog-entry)
Thanks!

Reassigned to Alexandre.
Comment 3 Johannes Segitz 2015-04-01 13:05:54 UTC 
openSUSE 13.1, 13.2 and Factory still need this fixed
Comment 4 Sebastian Wagner 2016-08-19 09:21:48 UTC 
Factory/Tumbleweed has 0.3.8, so fixed.

Couldn't find a reference in the packages for 13.1, 13.2 to this CVE or bug, so seems to be not fixed yet.
Comment 5 Andreas Stieger 2017-05-26 19:13:18 UTC 
13.1,13.2 is EOL. Leap 42.2 is at 0.3.7
Closing.